From 05b5d09ca70c5cc868f2108df4bcd3fcf6a7d865 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Sun, 9 Jan 2022 20:54:39 +0100
Subject: conntrack: T3579: migrate "conntrack ignore" tree to vyos-1x and
 nftables

---
 .../include/conntrack/log-common.xml.i             |  20 ++
 interface-definitions/system-conntrack.xml.in      | 205 +++++++++++++++++++++
 2 files changed, 225 insertions(+)
 create mode 100644 interface-definitions/include/conntrack/log-common.xml.i

(limited to 'interface-definitions')

diff --git a/interface-definitions/include/conntrack/log-common.xml.i b/interface-definitions/include/conntrack/log-common.xml.i
new file mode 100644
index 000000000..38799f8f4
--- /dev/null
+++ b/interface-definitions/include/conntrack/log-common.xml.i
@@ -0,0 +1,20 @@
+<!-- include start from conntrack/log-common.xml.i -->
+<leafNode name="destroy">
+  <properties>
+    <help>Log connection deletion</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="new">
+  <properties>
+    <help>Log connection creation</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<leafNode name="update">
+  <properties>
+    <help>Log connection updates</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/system-conntrack.xml.in b/interface-definitions/system-conntrack.xml.in
index daa4177c9..88f96a078 100644
--- a/interface-definitions/system-conntrack.xml.in
+++ b/interface-definitions/system-conntrack.xml.in
@@ -35,6 +35,128 @@
             </properties>
             <defaultValue>32768</defaultValue>
           </leafNode>
+          <node name="ignore">
+            <properties>
+              <help>Customized rules to ignore selective connection tracking</help>
+            </properties>
+            <children>
+              <tagNode name="rule">
+                <properties>
+                  <help>Rule number</help>
+                  <valueHelp>
+                    <format>u32:1-999999</format>
+                    <description>Number of conntrack ignore rule</description>
+                  </valueHelp>
+                  <constraint>
+                    <validator name="numeric" argument="--range 1-999999"/>
+                  </constraint>
+                  <constraintErrorMessage>Ignore rule number must be between 1 and 999999</constraintErrorMessage>
+                </properties>
+                <children>
+                  #include <include/generic-description.xml.i>
+                  <node name="destination">
+                    <properties>
+                      <help>Destination parameters</help>
+                    </properties>
+                    <children>
+                      #include <include/nat-address.xml.i>
+                      #include <include/nat-port.xml.i>
+                    </children>
+                  </node>
+                  <leafNode name="inbound-interface">
+                    <properties>
+                      <help>Interface to ignore connections tracking on</help>
+                      <completionHelp>
+                        <list>any</list>
+                        <script>${vyos_completion_dir}/list_interfaces.py</script>
+                      </completionHelp>
+                    </properties>
+                  </leafNode>
+                  #include <include/ip-protocol.xml.i>
+                  <leafNode name="protocol">
+                    <properties>
+                      <help>Protocol to match (protocol name, number, or "all")</help>
+                      <completionHelp>
+                        <script>${vyos_completion_dir}/list_protocols.sh</script>
+                        <list>all tcp_udp</list>
+                      </completionHelp>
+                      <valueHelp>
+                        <format>all</format>
+                        <description>All IP protocols</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>tcp_udp</format>
+                        <description>Both TCP and UDP</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>u32:0-255</format>
+                        <description>IP protocol number</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>&lt;protocol&gt;</format>
+                        <description>IP protocol name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>!&lt;protocol&gt;</format>
+                        <description>IP protocol name</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="ip-protocol"/>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                  <node name="source">
+                    <properties>
+                      <help>Source parameters</help>
+                    </properties>
+                    <children>
+                      #include <include/nat-address.xml.i>
+                      #include <include/nat-port.xml.i>
+                    </children>
+                  </node>
+                </children>
+              </tagNode>
+            </children>
+          </node>
+          <node name="log">
+            <properties>
+              <help>Log connection tracking events per protocol</help>
+            </properties>
+            <children>
+              <node name="icmp">
+                <properties>
+                  <help>Log connection tracking events for ICMP</help>
+                </properties>
+                <children>
+                  #include <include/conntrack/log-common.xml.i>
+                </children>
+              </node>
+              <node name="other">
+                <properties>
+                  <help>Log connection tracking events for all protocols other than TCP, UDP and ICMP</help>
+                </properties>
+                <children>
+                  #include <include/conntrack/log-common.xml.i>
+                </children>
+              </node>
+              <node name="tcp">
+                <properties>
+                  <help>Log connection tracking events for TCP</help>
+                </properties>
+                <children>
+                  #include <include/conntrack/log-common.xml.i>
+                </children>
+              </node>
+              <node name="udp">
+                <properties>
+                  <help>Log connection tracking events for UDP</help>
+                </properties>
+                <children>
+                  #include <include/conntrack/log-common.xml.i>
+                </children>
+              </node>
+            </children>
+          </node>
           <node name="modules">
             <properties>
               <help>Connection tracking modules</help>
@@ -155,6 +277,89 @@
               <help>Connection timeout options</help>
             </properties>
             <children>
+              <node name="custom">
+                <properties>
+                  <help>Define custom timeouts per connection</help>
+                </properties>
+                <children>
+                  <tagNode name="rule">
+                    <properties>
+                      <help>Rule number</help>
+                      <valueHelp>
+                        <format>u32:1-999999</format>
+                        <description>Number of conntrack rule</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="numeric" argument="--range 1-999999"/>
+                      </constraint>
+                      <constraintErrorMessage>Ignore rule number must be between 1 and 999999</constraintErrorMessage>
+                    </properties>
+                    <children>
+                      #include <include/generic-description.xml.i>
+                      <node name="destination">
+                        <properties>
+                          <help>Destination parameters</help>
+                        </properties>
+                        <children>
+                          #include <include/nat-address.xml.i>
+                          #include <include/nat-port.xml.i>
+                        </children>
+                      </node>
+                      <leafNode name="inbound-interface">
+                        <properties>
+                          <help>Interface to ignore connections tracking on</help>
+                          <completionHelp>
+                            <list>any</list>
+                            <script>${vyos_completion_dir}/list_interfaces.py</script>
+                          </completionHelp>
+                        </properties>
+                      </leafNode>
+                      #include <include/ip-protocol.xml.i>
+                      <leafNode name="protocol">
+                        <properties>
+                          <help>Protocol to match (protocol name, number, or "all")</help>
+                          <completionHelp>
+                            <script>${vyos_completion_dir}/list_protocols.sh</script>
+                            <list>all tcp_udp</list>
+                          </completionHelp>
+                          <valueHelp>
+                            <format>all</format>
+                            <description>All IP protocols</description>
+                          </valueHelp>
+                          <valueHelp>
+                            <format>tcp_udp</format>
+                            <description>Both TCP and UDP</description>
+                          </valueHelp>
+                          <valueHelp>
+                            <format>u32:0-255</format>
+                            <description>IP protocol number</description>
+                          </valueHelp>
+                          <valueHelp>
+                            <format>&lt;protocol&gt;</format>
+                            <description>IP protocol name</description>
+                          </valueHelp>
+                          <valueHelp>
+                            <format>!&lt;protocol&gt;</format>
+                            <description>IP protocol name</description>
+                          </valueHelp>
+                          <constraint>
+                            <validator name="ip-protocol"/>
+                          </constraint>
+                        </properties>
+                      </leafNode>
+                      <node name="source">
+                        <properties>
+                          <help>Source parameters</help>
+                        </properties>
+                        <children>
+                          #include <include/nat-address.xml.i>
+                          #include <include/nat-port.xml.i>
+                        </children>
+                      </node>
+                    </children>
+                  </tagNode>
+                </children>
+              </node>
               <leafNode name="icmp">
                 <properties>
                   <help>ICMP timeout in seconds</help>
-- 
cgit v1.2.3